{"action":"Upgrade tokio to 1.38.2 or later.","affected":[{"fixed":"1.44.2","introduced":"1.44.0"},{"fixed":"1.38.2","introduced":"0.2.5"},{"fixed":"1.43.1","introduced":"1.39.0"}],"component":"tokio","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["1.44.2","1.38.2","1.43.1"],"ghsa_id":"GHSA-rr8g-9fpq-6wmg","id":"tcs_01M5KF37AD1MRJX33FZF936PE8","modified_at":"2026-09-10T03:50:24.081979053Z","published_at":"2025-04-07T21:12:50Z","references":["https://osv.dev/vulnerability/GHSA-rr8g-9fpq-6wmg","https://github.com/tokio-rs/tokio/pull/7232","https://github.com/tokio-rs/tokio","https://rustsec.org/advisories/RUSTSEC-2025-0023.html"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-rr8g-9fpq-6wmg","url":"https://osv.dev/vulnerability/GHSA-rr8g-9fpq-6wmg"}],"summary":"Tokio broadcast channel calls clone in parallel, but does not require `Sync`"}